Vedaang/malware_analysis

1# Malware Analysis Dataset2 3This dataset contains memory forensics analysis data for malware research, including both benign and ransomware samples analyzed with Volatility Framework.4 5## Structure6 7### Dataset Repository (this repo)8- **Scripts**: Volatility automation scripts (`Automating_Volatility.py`, `Volshell_Automation.py`, `vboxelf.py`)9- **YARA Rules**: `malware_rules.yar` for malware detection10- **Scan Results**: Lightweight analysis outputs:11  - `malfind/` - Process memory injection detection12  - `pslist/` - Process listing13  - `psscan/` - Process scanning14  - `pstree/` - Process tree15  - `psxview/` - Process cross-view analysis16  - `yarascan/` - YARA rule matches17 18### Raw Data Bucket (`hf://buckets/Vedaang/malware-raw-dumps/`)19Large memory dumps and detailed scans stored separately:20- **`benign/`** - Benign memory dumps (6 × 4.5GB .raw files)21- **`benign/elf/`** - Benign ELF binaries (6 files)22- **`ransomware/`** - Ransomware memory dumps (12 × 4.5GB .raw files)23- **`ransomware/elf/`** - Ransomware ELF binaries (12 files)24- **`scans/memmap/`** - Detailed memory maps (large text files)25- **`scans/vadinfo/`** - VAD (Virtual Address Descriptor) info26- **`scans/vadwalk/`** - VAD walk analysis27 28## Sample Categories29 30### Benign Samples31- `base.raw` / `base.elf` - Baseline clean system32- `clean.raw` / `clean.elf` - Clean system snapshot33- `3.raw` - `10.raw` / `3.elf` - `10.elf` - Various benign workloads34 35### Ransomware Samples36| Sample | Family | Description |37|--------|--------|-------------|38| Annabelle | Annabelle | Ransomware |39| blue_howl | BlueHowl | Ransomware |40| cerber / cerber1 | Cerber | Ransomware |41| GandCrab | GandCrab | Ransomware |42| Jigsaw1 / Jigsaw2 | Jigsaw | Ransomware |43| TeslaCrypt1 | TeslaCrypt | Ransomware |44| Vipasna1 | Vipasna | Ransomware |45| ViraLock | ViraLock | Ransomware |46| WannaCry1 / WannaCry2 | WannaCry | Ransomware |47 48## Usage49 50### Access Dataset (Analysis Files)51```bash52hf download Vedaang/malware_analysis53```54 55### Access Raw Memory Dumps (Bucket)56```bash57# Install hf CLI if needed58pip install huggingface_hub[hf_transfer]59 60# Sync raw dumps61hf sync hf://buckets/Vedaang/malware-raw-dumps/benign ./local_benign --include "*.raw"62hf sync hf://buckets/Vedaang/malware-raw-dumps/ransomware ./local_ransomware --include "*.raw"63```64 65### Run Volatility Analysis66```bash67# Using included scripts68python Automating_Volatility.py -f memory.raw --profile Win10x64_1904169python Volshell_Automation.py -f memory.raw70```71 72## Analysis Tools73- **Volatility 3** - Memory forensics framework74- **YARA** - Pattern matching for malware identification75- **Custom Python scripts** - Automation wrappers76 77## Citation78If you use this dataset in research, please cite:79```80@dataset{malware_analysis_2026,81  author = {Vedaang Chopra},82  title = {Malware Analysis Memory Forensics Dataset},83  year = {2026},84  publisher = {Hugging Face},85  url = {https://huggingface.co/datasets/Vedaang/malware_analysis}86}87```88 89## License90This dataset is for research purposes only. Memory dumps contain no sensitive user data.91